When an enterprise plans to deploy mobile device technologies, it is MOST important for leadership to ensure that:

While an acceptable use policy is crucial for user awareness and compliance, it is a procedural control; the *implementation of technical and administrative controls* (the 'how') is more fundamental to actual security and risk mitigation.

Mobile devices introduce significant security and operational risks, such as data loss, unauthorized access, and malware, due to their portability and widespread use outside controlled environments. Therefore, it is paramount for leadership to ensure that appropriate technical and administrative controls (e.g., encryption, remote wipe, MDM solutions, strong authentication) are implemented to mitigate these risks and protect enterprise information assets and systems.

The IT policy addressing mobile devices is a foundational step, but merely having a policy doesn't guarantee security; the *implementation* of controls derived from that policy is the critical action.

Engaging the PMO is important for project execution efficiency, but it doesn't directly address the inherent security and operational risks associated with deploying mobile technology.